Audit shows lax financial controls

(Editor’s Note: This an abbreviated version of a report in this week’s newspaper.)

BOWLING GREEN – A recently completed audit of Caroline County revealed a lack of adequate financial controls and safeguards in a number of departments and some constitutional officers, including the officer of the treasurer.

In its report to the Board of Supervisors, the firm said it found a “material weakness” and six “significant deficiencies” in the county’s internal controls over financial reporting.

The audit was performed on the county’s finances for the 2011-12 fiscal year. County officials already have responded to many of the deficiencies cited by the auditors and taken corrective action. They also plan to take additional action as recommended by the auditing firm, PBMares in Harrisonburg.

In a separate 10-page letter to county management, the firm also described a number of lax financial controls in various departments and constitutional offices and suggested remedies in order to prevent theft or abuse. The areas of concern included inadequate controls related to county employees using gas cards and credit cards, among other things. County officials also have responded to many of these concerns and plan additional action.

The Caroline Progress contacted via e-mail County Administrator Charles Culley, Frances Hatcher, director of the department of finance, Cynthia Green, director of the department of social services, Donnell Howard, director of the department of parks and recreation, Commissioner of Revenue Sharon Carter, Treasurer Elizabeth Curran, and Sheriff Tony Lippa in order to give them an opportunity to comment on the PBMares report and letter to management. Only Culley and Lippa replied to the newspaper.

In a response via e-mail, Culley immediately distanced himself from the audit, pointing out it was for the fiscal year ending June 30, 2012. “I got here May first,” he said, of last year.

“We have been working to correct the things the auditors have brought to our attention,” Culley added. “Remember the letter separate from the audit includes suggestions for management, not requirements. That is a significant point…Overall, we had a good clean audit and corrective actions for issues raised in the audit were included.”

“They didn’t report any problems of fraud or abuse,” added Culley. “They just suggested changes to help prevent those problems from arising.”

PBMares noted in a number of instances that, because of the lack of various financial controls, it would not have been able to detect instances of fraud or abuse.

In the PBMares letter to management, the first thing addressed by the auditors was the lack of a comprehensive manual of internal control policies and procedures. It identified existing policies that were either “outdated or no longer relevant” and said county employees did not understand or were unfamiliar with them. County officials are developing a manual they expect to complete by the end of the fiscal year, June 30.

In the commissioner of revenue’s office, the auditors discovered all users of a computer system were using the same login and password information. “Although this practice may be convenient, the lack of controls over user access and the provision of an audit trail of transactional history per individual is a weakness that needs to be corrected. Without separate login and user rights established, any investigations into the system to identify potential errors or fraud would be virtually impossible,” the auditors said in the management letter.

The issue was brought to the attention of Carter and the county’s information technology staff and was remedied immediately, the auditors noted. All employees in the office now have their own user login and password to access the system.

The county’s department of social services purchased 200 gift cards at $25 each – a total of $5,000 – to be distributed to eligible participants in the welfare-to-work program, known as VIEW, in order to purchase gas. However, the department maintained no records of who received the cards, according to PBMares; in cases where there was documentation, it was inadequate. “We discussed this issue with the department, and efforts were made at that point to reconcile the cards purchased and issued; however, as of the completion of audit fieldwork, this had not been successfully completed.”

The auditors recommended a log of transactions be maintained in the future to prevent theft. “Transactions of this type inherently lend themselves to the possibility of theft or other defalcation, and the simple application of the procedures noted will enhance controls to an acceptable level,” the auditors wrote.

The auditors also visited sites where county employees collect various cash payments. “We found instances in which we believe internal controls over collections can be strengthened.” Although PBMares noted that the amounts of cash transacted were “immaterial,” it recommended implementing some inexpensive controls to “protect against potential theft and error.”

It particularly singled out the county’s department of parks and recreation. “Although collections are likely minimal and immaterial we think the controls of the collections in the Parks and Recreation department could be strengthened. We specifically note that controls appear weak for receipts collected during ‘open gym.’ ”

“Additionally, we noted that receipts are currently being issued for only cash receipts, and not when a patron pays with a check. We also noted there appears to be a difficulty in reconciling total receipts for this department.”

“Similarly, support for collections at Fire and Rescue does not appear sufficient, although collections here are likely minimal,” said PBMares.

The report also noted the cash register at the department of planning and community development was unlocked, and that the key was in the lock and within easy reach of customers at the counter.

The auditors recommended that departments that collect cash should have a safe in the event that it cannot be delivered to the treasurer’s office on a daily basis.

In a brief memorandum to Culley in response to the letter, Hatcher wrote, “Procedures have been established to provide more control over cash collections.” The recommendation regarding safes had not been implemented, she added.

PBMares also found “deficiencies in the controls” related to use of cards to purchase gasoline. For example, it found sharing of PIN numbers, failure to record actual vehicle mileage, failure to review statements in order to identify misstatements or other issues. Controls over such transactions including credit cards, are “very important,” it noted in the report, because “effective controls…could potentially prevent negative exposure to the county should theft or defalcation occur.”

“Although the potential theft or misuse would not likely rise to a quantitatively material level without being identified, we believe the potential effects of a lack in controls could have a qualitatively significant affect (sic) on the county. We recommend the use of gas cards be reviewed and support for each transaction be highly scrutinized and employees held accountable for all use.”

“Review and signatures are required on the backup to the (vendor) invoice,” wrote Hatcher in her corresponding memo. “Most departments maintain a fuel log. There have been instances when an invalid PIN was used, but this is now handled immediately upon notification by (vendor).”

Several receipts and other supporting documentation for charges on county credit cards “were not maintained or provided” to the finance department, said PBMares. “One of the departments with this deficiency was the Sheriff’s Office, for which it is common practice to not provide supporting documentation to the Finance Department. This practice could result in the payment of unsubstantiated expenses.” In some cases when supporting documentation was provided, “it was untimely or provided in the incorrect month, making it difficult to reconcile the expense prior to payment.” PBMares also requested a list from Lippa of who has been issued cards and the limit for each card, but the sheriff’s office did not provide the information.

“We recommend the county require that supporting receipts be submitted for all charges for which it is practical to obtain a receipt and that the business purpose of the expense be clearly documented,” the auditors wrote. “This should be extended to all departments of the county. Additionally, we think a thorough review of the individuals to whom cards have been issued, as well as the limits per card and per transaction, be performed and documented.”

All departments now provide receipts for credit card usage to her department, wrote Hatcher. “If a receipt is missing, other documentation is included and approved by the department head before submittal to finance.” The county also is researching a purchasing card system instead of using credit cards, she added.

In an e-mail to the newspaper, Lippa said his office concurred “that it could be beneficial” for the finance department to have documentation to support credit card charges – documentation it keeps on file – and has begun taking steps to supply the information. The documentation never was previously requested of his office, he added.

He and his staff “vigorously dispute” the statement by PBMares in its management letter that the sheriff’s office did not provide a list of employees who have been issued credit cards and the limits of each card.

“No member of my staff has any recollection nor have they been able to find any record of such a request,” said Lippa. “Furthermore, this exact information was readily available in the files and records that were made open and available to the auditors.” The information has since been forwarded to Hatcher’s office, he said.

In addition, credit card purchases and other purchases recently were audited by the Virginia Law Enforcement Professional Standards Commission, said Lippa. The commission found no concerns about credit card purchases or procurement procedures, he said, and concluded the sheriff’s office demonstrates “integrity and commitment to professionalism.”

The treasurer’s office performs monthly bank reconciliations, but in some instances it did not appear to provide adequate support to the finance department for review. “For instance, it was noted finance is not provided with copies of many of the bank statements, so that amounts recorded, particularly revenues, can be verified and corroborated in order to be properly recorded. If support of this nature can be provided to the finance department on a timely basis, it will provide an additional level of control over financial reporting and mitigate the possibility of a potential misstatement.”

PBMares called it “the most prominent instance” of adequate support not being provided to Hatcher’s office, but it noted that “this practice can occasionally occur within other departments as well.”

In her memo briefly summarizing responses, Hatcher wrote, “This is being reviewed by the treasurer.”

In the school division, PBMares noted that “significant accounting processes, including payroll, should be segregated to the fullest extent” in order to avoid potential fraud errors, and to provide continuity of operations. The school administration currently has one person responsible for entering new employee information, changing pay rates, processing payroll, and releasing payroll information.

When Bowling Green Elementary School is consolidated with the opening of the expanded and refurbished Bowling Green Primary School, a clerical worker will be reassigned to assume payroll-related duties, said Superintendent Greg Killough. “That will create that check and balance they are looking for,” he said in discussing the audit on Friday of last week. “So there is a plan in place.” The change should be in place by July 1, he said.

In the letter to management, PBMares also noted the county did not have a requirement for constitutional officers to submit timesheets to the finance department, recommended the establishment of a self-insurance fund instead of reporting self-insurance activities as a portion of the general fund, and recommended the review and elimination of inter-fund receivables and payables. In addition, Hatcher revealed that her department has not been receiving timesheets from full-time, salaried personnel of the department of social services.

One constitutional officer has begun providing timesheets, and the other officers and social services are being notified of the new requirement, wrote Hatcher.

The issue of the time sheets relate to provisions of the Fair Labor Standards Act rather than financial requirements, said Culley. “Each officer maintains their own personnel records including time sheets. The issue was about finance not receiving copies of the same.”

The Board of Supervisors acted in December 2012 to approve the review and elimination of inter-fund receivables and payables. Finally, county staff is studying the suggestion to establish a self-insurance fund, wrote Hatcher.

In its formal report, under “findings and questioned costs,” PBMares described a “material weakness” in internal controls.

“A material weakness is a deficiency, of a combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement of the county’s financial statements will be prevented, or detected and corrected on a timely basis,” the firm reported.

The “material weaknesses” was related to instances of “material adjustments, including entries to restate prior periods,” to year-end balances. It recommended “increased levels of due diligence in maintaining proper schedules to support accurate balances.” In its corrective action plan, the county administration said it has strengthened reviews of general ledger accounts to verify accuracy in balances and “identified resources to assist in understanding questionable or confusing accounting.”

PBMares also identified six areas of “significant deficiency,” which it characterized as not as severe as a “material weakness” but “important enough to merit attention by those charged with governance.”

The firm reported a “significant deficiency” related to segregating duties in the treasurer’s office related to wire transfers, cash receipts, payments, and reconciliation of these amounts. Such duties should be segregated in order to “mitigate risks of fraud or error,” the auditors wrote. Without the check and balance of requiring a secondary approval for a wire transfer or adequate controls over the other activities, the county is at risk of fraud or error, it noted. “Additionally, this fraud or error could result in a significant amount, due to the volume of the transactions (including wire transfers) occurring in the treasurer’s office.”

In response to the auditors’ finding related to wire transfers in the treasurer’s office, the county administration said it would establish procedures to document that transfers are initiated by one employee and approved by another. As an additional control, the original mailed copy of the wire transfer from the bank will be provided to Hatcher for her records. As to the segregation of other duties in the treasurer’s office, county administration noted “inherent limitations due to the size of our staff.” Hatcher has been given access to the online banking system as a compensating control, and she will be provided a copy of the bank reconciliation when the general ledger is closed each month.